Nikkei Discloses Separate M365 and Google Workspace Intrusions Exposing 1,646 Records and Enabling 9,000 Phishing Emails

The Microsoft 365 account was used to target prior correspondents with links to malicious sites, while the Google Workspace incident, detected via Google alert in early August, showed no subsequent logins after password reset. Neither compromise has been attributed to any group, and Nikkei has not confirmed operational linkage between the two.

Prior incidents include a November 2025 malware infection on an employee device that led to Slack credential theft affecting over 17,000 records, plus a 2022 ransomware hit on the Singapore office. These cases reveal a pattern of initial access via employee endpoints rather than perimeter defenses.

The disclosures coincide with similar vendor and account compromises at Daiwa Securities and Yamato Transport, indicating Japanese firms face sustained pressure on third-party and SaaS identities. Media organizations hold source contact data that cannot be easily rotated, amplifying downstream risks.

Expect continued monitoring for follow-on phishing campaigns impersonating Nikkei staff, with potential regulatory scrutiny from Japan's data protection authority on access controls for journalistic platforms.